Backup copying and restoration of Administration Server data

Data backup allows you to move Administration Server from one device to another without data loss. Through backup, you can restore data when moving the Administration Server database to another device, or when upgrading to a newer version of Kaspersky Security Center. Also, you can use data backup to move Administration Server data from Kaspersky Security Center Windows under management of Kaspersky Security Center Linux (moving data from Kaspersky Security Center Linux to Kaspersky Security Center Windows is not supported).

The installed management plug-ins are not backed up. After you restore Administration Server data from a backup copy, you need to download and reinstall plug-ins for managed applications.

Before you back up the Administration Server data, perform the following actions:

Follow requirements for creating a backup on Administration Server 16 or earlier and restoring it on version 16.1 or later
- If you create a data backup on Administration Server 16 or earlier and restore it on Administration Server 16.1 or later, two-factor authentication is enabled. For more information, refer to About two-factor authentication for an account.
  To ensure that users can sign in to Web Console with their existing accounts by using configured two-factor authentication secret keys, and that OpenAPI automation scripts continue to work after the restore, you must perform the following steps:
  - Enable two-factor authentication for all users
  - Administrators must configure two-factor authentication for their own accounts
  - Exclude the required accounts from two-factor authentication
    If needed, add integration accounts used to run scripts through OpenAPI to the exclusion list.
  If it is not possible to configure two-factor authentication before creating the backup, user accounts will be added to the two-factor authentication allow list and will be able to configure two-factor authentication when signing in to the Web Console. More detailed conditions for adding an account to the allow list are described in the topic Allowing users to configure two-factor authentication.
Check whether a virtual Administration Server is added to the administration group. If a virtual Administration Server is added, make sure that an administrator is assigned to this virtual Administration Server before the backup. You cannot grant the administrator access rights to the virtual Administration Server after the backup. Note that if the administrator account credentials are lost, you will not be able to assign a new administrator to the virtual Administrator Server.
If you want to backup or restore a Kaspersky Security Center Linux failover cluster, you must stop the entire cluster for maintenance and then restart it when backup or restoration is completed.

You can create a backup copy of Administration Server data in one of the following ways:

By creating and running a data backup task through Kaspersky Security Center Web Console.
By running the klbackup utility on the device that has Administration Server installed. This utility is included in the Kaspersky Security Center distribution kit. After the installation of Administration Server, the utility is located in the root of the destination folder specified at the application installation (usually, /opt/kaspersky/ksc64/sbin/klbackup).

The following data is saved in the backup copy of Administration Server:

Database of Administration Server (policies, tasks, application settings, events saved on the Administration Server).
Configuration details of the structure of administration groups and client devices.
Repository of distribution packages of applications for remote installation.
Administration Server certificate.
Two-factor authentication secret keys configured for user accounts.
List of user accounts excluded from two-factor authentication.

You can create a backup copy of Administration Server data either by creating and running a data backup task or by using the klbackup utility. Restoration of Administration Server data is only possible by using the klbackup utility. You must perform the restoration on an operable instance of Administration Server that has just been installed and has the same version (or later) for which the backup copy was created. Do not use any third-party tools for backup or restoration, and if possible, do not remove the previous Kaspersky Security Center Linux installation until the configuration and data transfer are fully completed.

In this section

Creating an Administration Server data backup task

Using the klbackup utility to back up and recover data

Using the klbackup utility to switch managed devices under management of another Administration Server

Backup and restoring Administration Server data when using MySQL or MariaDB